1. Based on SOX, which of the following sections is about internal controls?
a. 302
b. 401
c. 404
d. 906

2. SOX requires companies to use COSO or COSO ERM as the framework in evaluating internal controls.
a. True
b. False

3. Controls that are designed to prevent, detect, or correct errors in transactions as they are processed through a specific subsystem are referred to as:
a. General controls.
b. Application controls.
c. Physical controls.
d. Two of the above are correct.
e. None of the above are correct.

4. Which of the following is not a COSO ERM control objective?
a. Risk assessment
b. Compliance
c. Reporting
d. Operations
e. Strategic

5. Pre-numbering of source documents helps to verify that:
a. Multiple types of source documents have a unique identifier.
b. All transactions have been recorded because the numerical sequence serves as a control.
c. No inventory has been misplaced.
d. Documents have been used in order.

6. A field check is a(n):
a. Preventive control.
b. Detective control.
c. Corrective control.
d. General control.
e. Output control.

7. Which is not an example of a batch total?
a. Record count
b. Financial total
c. Hash total
d. Exception total

8. Backup is a preventive control.
a. True
b. False

9. The computer sums the first four digits of a customer number to calculate the value of the fifth digit and then compares that calculation to the number typed during data entry. This is an example of a:
a. Field check.
b. Parity check.
c. Check digit verification.
d. Batch total.

10. Which of the following statements is correct?
a. SOX requires all public companies to use the COSO ERM framework to meet the requirements of section 404.
b. Regarding IT control and governance, the COBIT framework is most commonly adopted by companies in the United States.
c. ITIL is the best internal control framework for the high-tech industry.
d. ISO 27000 series are best practices for IT service management.